Hybrid working and the continued security challenges for financial organisations

By Andrew Gehrlein, Chief Financial Officer, Park Place Technologies

Earlier this year, leading global management consulting firm McKinsey, published its comprehensive report on the future of the physical workplace¹ moving though pre, current and post Covid-19 scenarios. Across the report’s twenty conclusions, garnered from both employer and employee perspectives, one seems indelibly etched in determining the future of the physical workplace – that globally, the majority of employees (52%), would prefer a continued hybrid model of working. McKinsey expanded the definition of hybrid workplaces to include the usage of flexible workspaces that are physically located outside of existing company office locations and to include home office workspaces alongside hub working and communal space works.  In the world of Financial Services, from which IT has been traditionally delivered from centralised, highly secured locations housed from clusters of expertise – such as those in the City of London, or the Financial District of New York, or the Central District of Hong Kong – how, in the current and post Covid-19 world, do finance infrastructure leads accommodate this ongoing transfer of working conditions, especially with the increased security parameters that the world of trading demands?

Since the initial reactionary rush to accommodate working from home mandates in March 2020, these IT infrastructure leads have now had the benefit of time and experience to consider, mitigate and control the security impacts that continued hybrid working poses. Today, these leads are proactively focused on developing a clear, structured and continued strategy for those organisations and employees who elect to work outside of company facilities. This is a monumental task in any sector, but compounded in financial services where speed, security and increased regulatory pressures are paramount considerations in any financial exchange. Hybrid staff continually need to access devices and exchange data above and beyond the usual elaborate security firewalls that these organisations typically embrace from within fixed corporate networks. This flexible requirement is a tall order when you consider that in practice, these IT leads now have to map and identify all possible ingress and egress points in their newly expanded dispersed network before holistically deploying enhanced next generation security and cyber services to give increased protection from hostile activities. This also includes systematic and ongoing understanding of endpoint usage, with endpoints themselves needing to be capable of being restricted and isolated quickly, centrally and regardless of physical location, in order to avoid further contamination should a security breach occur.

Mapping all devices is clearly an essential start-point. Within a hybrid working strategy, organisations also need to develop a clear understanding of usage of the cloud accounts that access corporate services. Of course, the nature of cloud service provision means that much of this is dynamic, on the fly and complex to track. Additionally, public network usage provides further challenges and need for increased vigilance and staff training in settings such as hub and communal spaces. As an example, data transfer to a wireless printer inside a secure corporate facility poses relatively little risk. Place the same wireless printer within a hub space and the possibilities for breaches increase manyfold. Equally in the home environment additional vulnerabilities exist. These can include; routers with exposed modem control interfaces; or staff using their own devices that may fall outside of patching windows; or the dramatic increase in domestic IoT exposure points, all of which need additional consideration within a permanent hybrid working strategy. Faced with these levels of challenges, it becomes quickly apparent that finance IT leads essentially need a real-time, always-on, centrally managed discovery and monitoring system of devices and data.

How can this be achieved? Pre-Covid, IT Asset and inventory device management was limited largely to a manual discovery and tracking that assisted with security and auditory requirements. Faced with the complexity and threats outlined outside of corporate locations, today this discovery has to be conducted as an ongoing service, in real-time, expanded across multiple remote locations for immediate discovery; automating and simplifying asset disclosure without manual IT inventory collection. In short, discovery in this new hybrid working world needs to provide complete visibility across financial services’ data centres and cloud environments, and should include servers (physical, virtual & cloud), desktops, peripherals, edge devices, alongside infrastructure services.

Discovery is the first step. Monitoring networks of this complexity is the second. Network monitoring tools have become increasingly specialised and siloed towards departmental usage, neglecting the holistic cross-departmental immediacy that hybrid working needs. What’s required today is proactive and predictive generic monitoring across hardware and software that gives IT leads fast and actionable insights to gain the greatest level of controls while allowing identified new devices to be quickly added to the protection fold. Only then, when there is a complete understanding of what hybrid workers are using at any given point in time, can the appropriate protection and cyber solutions be confidently layered, safe in the knowledge that there are no gaps within defences.

¹https://www.mckinsey.com/business-functions/people-and-organizational-performance/our-insights/what-employees-are-saying-about-the-future-of-remote-work.

By Andrew Gehrlein, Chief Financial Officer, Park Place Technologies

Earlier this year, leading global management consulting firm McKinsey, published its comprehensive report on the future of the physical workplace¹ moving though pre, current and post Covid-19 scenarios. Across the report’s twenty conclusions, garnered from both employer and employee perspectives, one seems indelibly etched in determining the future of the physical workplace – that globally, the majority of employees (52%), would prefer a continued hybrid model of working. McKinsey expanded the definition of hybrid workplaces to include the usage of flexible workspaces that are physically located outside of existing company office locations and to include home office workspaces alongside hub working and communal space works.  In the world of Financial Services, from which IT has been traditionally delivered from centralised, highly secured locations housed from clusters of expertise – such as those in the City of London, or the Financial District of New York, or the Central District of Hong Kong – how, in the current and post Covid-19 world, do finance infrastructure leads accommodate this ongoing transfer of working conditions, especially with the increased security parameters that the world of trading demands?

Since the initial reactionary rush to accommodate working from home mandates in March 2020, these IT infrastructure leads have now had the benefit of time and experience to consider, mitigate and control the security impacts that continued hybrid working poses. Today, these leads are proactively focused on developing a clear, structured and continued strategy for those organisations and employees who elect to work outside of company facilities. This is a monumental task in any sector, but compounded in financial services where speed, security and increased regulatory pressures are paramount considerations in any financial exchange. Hybrid staff continually need to access devices and exchange data above and beyond the usual elaborate security firewalls that these organisations typically embrace from within fixed corporate networks. This flexible requirement is a tall order when you consider that in practice, these IT leads now have to map and identify all possible ingress and egress points in their newly expanded dispersed network before holistically deploying enhanced next generation security and cyber services to give increased protection from hostile activities. This also includes systematic and ongoing understanding of endpoint usage, with endpoints themselves needing to be capable of being restricted and isolated quickly, centrally and regardless of physical location, in order to avoid further contamination should a security breach occur.

Mapping all devices is clearly an essential start-point. Within a hybrid working strategy, organisations also need to develop a clear understanding of usage of the cloud accounts that access corporate services. Of course, the nature of cloud service provision means that much of this is dynamic, on the fly and complex to track. Additionally, public network usage provides further challenges and need for increased vigilance and staff training in settings such as hub and communal spaces. As an example, data transfer to a wireless printer inside a secure corporate facility poses relatively little risk. Place the same wireless printer within a hub space and the possibilities for breaches increase manyfold. Equally in the home environment additional vulnerabilities exist. These can include; routers with exposed modem control interfaces; or staff using their own devices that may fall outside of patching windows; or the dramatic increase in domestic IoT exposure points, all of which need additional consideration within a permanent hybrid working strategy. Faced with these levels of challenges, it becomes quickly apparent that finance IT leads essentially need a real-time, always-on, centrally managed discovery and monitoring system of devices and data.

How can this be achieved? Pre-Covid, IT Asset and inventory device management was limited largely to a manual discovery and tracking that assisted with security and auditory requirements. Faced with the complexity and threats outlined outside of corporate locations, today this discovery has to be conducted as an ongoing service, in real-time, expanded across multiple remote locations for immediate discovery; automating and simplifying asset disclosure without manual IT inventory collection. In short, discovery in this new hybrid working world needs to provide complete visibility across financial services’ data centres and cloud environments, and should include servers (physical, virtual & cloud), desktops, peripherals, edge devices, alongside infrastructure services.

Discovery is the first step. Monitoring networks of this complexity is the second. Network monitoring tools have become increasingly specialised and siloed towards departmental usage, neglecting the holistic cross-departmental immediacy that hybrid working needs. What’s required today is proactive and predictive generic monitoring across hardware and software that gives IT leads fast and actionable insights to gain the greatest level of controls while allowing identified new devices to be quickly added to the protection fold. Only then, when there is a complete understanding of what hybrid workers are using at any given point in time, can the appropriate protection and cyber solutions be confidently layered, safe in the knowledge that there are no gaps within defences.

¹https://www.mckinsey.com/business-functions/people-and-organizational-performance/our-insights/what-employees-are-saying-about-the-future-of-remote-work.